Child processes spawned by Renovate incorrectly have full access to environment variables
When Renovate spawns child processes, their access to environment variables is filtered to an allowlist, to prevent unauthorized access to privileged credentials that the Renovate process has access to.
Since 42.68.1 (2025-12-30), this filtering had been inadvertently removed, and so any child processes spawned from these versions will have had access to any environment variables that Renovate has access to.
This could lead to insider attackers and outside attackers being able to exflitrate secrets from the Renovate deployment.
It is recommended to rotate (+ revoke) any credentials that Renovate has access to, in case any spawned child processes have attempted to exfiltrate any secrets.
Impact
Child processes spawned by Renovate (i.e. npm install, anything defined in postUpgradeTasks or postUpdateOptions) will have full access to the environment variables that the Renovate process has.
This could lead to insider attackers and outside attackers being able to exflitrate secrets from the Renovate deployment.
Patches
This is patched in 42.96.3 and 43.4.4.
Workarounds
There are no workarounds, other than upgrading your Renovate version.
Why did this happen?
As part of work towards https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96, one of the preparatory changes we made was moving to execa.
One of the default behaviours of execa is to extend the process' environment variables with any new ones, rather than override them.
This was missed in code review, which meant that since this version, the full environment variables have been provided to any child processes spawned with execa by Renovate.
This was discovered as part of an unrelated change.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Paczka npm | renovate | >= 42.68.1, < 42.96.3, >= 43.0.0, < 43.4.4 | 42.96.3, 43.4.4 |
Odnośniki
- Wektor CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Słabość (CWE)
CWE-269- Platforma
- npm
- Paczka
renovate- Ujawniono
- 13.02.2026
- Aktualizacja
- 11.10.2026 10:22
Źródła i licencje
OSV / GitHub Advisory Database - GHSA-8wc6-vgrq-x6cf - CC BY 4.0
Historia podatności: renovate
Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 11
- Pierwsza → ostatnia
- 10.2019 04.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Średnia 11
Ujawnienia w latach
- 2019: 1
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 8
-
Child processes spawned by Renovate incorrectly have full access to environment variables ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.